Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-54133jmespath.php has CompilerRuntime code injection via unescaped function names
Critical 9.8
In plain English
A critical-severity improper input validation in jmespath.php from jmespath. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mtdowling/jmespath.php | 2.9.1 | GHSA-pcw8-m77r-2528 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jmespath | jmespath.php | < 2.9.1 |
Weakness: CWE-20, CWE-94, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/jmespath/jmespath.php/security/advisories/GHSA-pcw8-m77r-2528 x_refsource_CONFIRM